Researchers at ETH Zurich’s Center for Security Studies identified 407 cyber incidents affecting 183 space-related entities during 2025. The findings show that space cybersecurity already involves substantial activity against infrastructure on Earth. Every documented incident in this assessment affected terrestrial space systems or organizational information technology, rather than directly targeting a satellite in orbit. For businesses buying satellite services, the immediate relevance lies in the networks, accounts and equipment connecting those services to customers.
Published on September 30, 2026, the center’s research summary also identified 139 threat actors. Hacktivist groups represented the majority, and distributed denial-of-service attacks were the most frequently observed activity. These attacks overwhelm services with traffic or requests. Ransomware and data theft created additional exposure, connecting the space sector’s security problems with methods already familiar to banks, hospitals and other infrastructure operators.
Clémence Poirier, a senior cyberdefense researcher at the center, explained the findings in an October 12 World Economic Forum feature. Her central argument concerns visibility: public incident records reflect what organizations can detect, what becomes public and what researchers can verify. The absence of documented orbital attacks cannot establish that spacecraft are unaffected, because the instruments needed to identify malicious activity aboard satellites are often missing.
That distinction gives the report practical value beyond its headline total. An incident count describes the evidence available to researchers, not the probability that an individual satellite will be compromised. Changes in disclosure, monitoring and the boundaries used to define a space company can change that count. Comparing totals across years requires consistent methods and attention to those factors.
Space services depend on several connected environments. A spacecraft carries mission equipment and onboard computers; ground facilities manage its operations; communications equipment connects the system with users. Corporate systems support engineering, administration and supplier relationships. Security failures can affect different parts of this arrangement, with different consequences. A stolen business document, a disabled customer terminal and an unauthorized spacecraft command are separate events requiring different responses.
The National Institute of Standards and Technology examined this operational structure in its December 2022 report on satellite command and control. Written by Suzanne Lightman, Theresa Suloway and Joseph Brule, the report applies the NIST Cybersecurity Framework to the ground segment. Its emphasis is important: protecting a satellite requires attention to the Earth-based systems that direct its bus, meaning its basic supporting platform, and its mission payload.
The framework organizes security work around identifying assets and risks, protecting systems, detecting incidents, responding and recovering. Applied to satellite operations, this approach connects technical safeguards with operational responsibilities. An organization needs to understand which systems can send commands, which personnel can authorize actions and how essential functions will continue after disruption. Command security and service recovery become part of mission management rather than isolated computer-maintenance tasks.
A documented example is the February 24, 2022 attack on Viasat’s KA-SAT broadband network. In its March 30 incident account, Viasat reported disruption affecting several thousand customers in Ukraine and tens of thousands elsewhere in Europe. The company said the incident affected one consumer-service partition and did not affect its directly managed mobility or government users on that satellite.
Viasat reported no evidence that the satellite itself had been compromised. Recovery included software updates for some modems and shipment of tens of thousands of replacement modems to distributors. This historical case illustrates how an attack can interrupt a satellite service without disabling the spacecraft. It also shows why restoration involves equipment logistics and customer support as well as technical investigation.
For maritime customers, this distinction has direct operational meaning. Ships use satellite links for weather information, maintenance communications, cargo records and crew connectivity. New Space Economy’s coverage of maritime satellite cybersecurity describes how terminals, onboard networks, shore support and remote-access arrangements distribute responsibility among several suppliers. Clear ownership of patching, access privileges and incident records helps turn a connectivity contract into a manageable operating arrangement.
Technical communities are also developing more specific ways to describe spacecraft threats. The Aerospace Corporation’s Space Attack Research and Tactic Analysis framework, known as SPARTA, organizes adversary behavior into tactics, techniques and procedures. The purpose is to give spacecraft developers, owners and operators a shared vocabulary for examining how attacks could progress and which countermeasures could interrupt them.
Aerospace identifies system development, defensive operations, threat-intelligence reporting and exercises among SPARTA’s uses. This gives engineering and security teams a structured basis for discussion. Instead of relying on a broad statement that a mission needs cybersecurity, they can examine particular behaviors, affected components and defensive measures. A common description also makes information from separate organizations easier to compare.
Poirier’s analysis connects these frameworks with the need for better detection. Operational telemetry describes spacecraft condition and behavior, but security analysis requires evidence that can distinguish suspicious activity from normal operation or equipment faults. Dedicated detection capabilities, useful records and specialist interpretation can help investigators reconstruct events. Those findings can then inform defenses on other missions.
Information sharing is another proposed improvement. Poirier recommends participation in trusted communities that exchange cyber and physical threat intelligence. Such exchanges need not disclose sensitive mission details publicly. Their value comes from making relevant observations available to organizations facing comparable systems and threats, including operators that cannot maintain large investigative teams independently.
The commercial significance extends to organizations purchasing satellite connectivity, imagery and other services. Security performance depends partly on arrangements outside the customer’s own network. Buyers can evaluate who controls access, which incident records are retained, how suppliers coordinate a response and how service restoration is tested. These are identifiable operating responsibilities, rather than an abstract judgment about whether space is secure.
The research supports a specific direction for improvement: combine protection of terrestrial infrastructure with better observation of spacecraft behavior. Ground-system safeguards address documented incidents; dedicated detection and shared threat descriptions improve the evidence available for future decisions. Together, these activities allow satellite operators and their customers to base security priorities on identifiable assets, observed behavior and workable response procedures.
Useful Books Available on Amazon
